The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process arbitrary user-provided text, samples, and JSON profiles, which creates a surface for indirect prompt injection where malicious instructions embedded in the data could attempt to hijack the agent's execution flow.
Ingestion points: The skill accepts untrusted data through the <text>, <samples...>, and <profile.json> parameters in SKILL.md and references/brand-voice-profile.md.
Boundary markers: The instructions do not define strict delimiters or include warnings for the agent to ignore instructions found within the input text, increasing the likelihood that the agent might obey embedded commands.
Capability inventory: The skill has access to powerful tools including Bash, Write, Edit, Grep, and Glob, which could be abused if an injection attack is successful.
Sanitization: There is no evidence of input sanitization, schema validation for the JSON profiles beyond structure, or filtering of the processed text to remove potential command patterns.

tone-shifter